New data was added to a monitored input file, but searches display only older data.
Which splunkd.log channel would help troubleshoot this problem?
splunkd.log
TailingProcessor handles monitored uncompressed log files, including tracking the read position and detecting appended data. Its splunkd.log messages are therefore relevant when newly added file content is not appearing in searches. Splunk documents that its tailing code handles uncompressed log files and that the file-monitoring process uses file identity and seek information to determine what has already been read.
TailingProcessor
Community Discussion